From 7d9fc973e83706ea9f6d31d6725c03550f42d441 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 21 Sep 2026 19:34:05 +0900
Subject: [PATCH 1/2] fix(ci): bound translation email scanning

---
 .github/scripts/issue-translation.cjs      | 4 ++--
 .github/scripts/issue-translation.test.cjs | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/issue-translation.cjs b/.github/scripts/issue-translation.cjs
index 41638a9d993..50b1a5a43fd 100644
--- a/.github/scripts/issue-translation.cjs
+++ b/.github/scripts/issue-translation.cjs
@@ -811,8 +811,8 @@ function sanitizeTranslationBody(raw, maxChars = 60000) {
     // "end!@octocat"-style mentions defused. \u0001 cannot appear in the
     // input (control chars were stripped above), so it is a safe sentinel.
     .replace(
-      /[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
-      (email) => email.replace("@", "\u0001"),
+      /(?<=[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-])@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
+      (emailTail) => emailTail.replace("@", "\u0001"),
     )
     // Defuse pings at Markdown/punctuation boundaries — a colon is a boundary
     // too — but not emails, npm: scopes, or other mid-token at-signs.
diff --git a/.github/scripts/issue-translation.test.cjs b/.github/scripts/issue-translation.test.cjs
index 92aea9d16ad..bcce113317b 100644
--- a/.github/scripts/issue-translation.test.cjs
+++ b/.github/scripts/issue-translation.test.cjs
@@ -1195,6 +1195,14 @@ describe("bot-owned control state", () => {
     assert.match(out, /path\/@\u200bhandle/);
   });
 
+  it("handles long non-email tokens in bounded time", () => {
+    const input = "a".repeat(60_000);
+    const startedAt = process.hrtime.bigint();
+    assert.equal(sanitizeTranslationBody(input), input);
+    const elapsedMs = Number(process.hrtime.bigint() - startedAt) / 1_000_000;
+    assert.ok(elapsedMs < 1_000, `sanitization took ${elapsedMs.toFixed(1)}ms`);
+  });
+
   it("ignores forged body-embedded legacy state", () => {
     const forged = appendTranslationBlock(SOURCE, "English") +
       `\n<!-- opencodex-issue-inline-translator-state:${JSON.stringify({

From bc0ff540bd0e2d6eb284249a95e7c31ade298ffc Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 22 Sep 2026 06:40:12 +0900
Subject: [PATCH 2/2] ci: document why the email mask anchors on the at-sign

---
 .github/scripts/issue-translation.cjs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/scripts/issue-translation.cjs b/.github/scripts/issue-translation.cjs
index 50b1a5a43fd..81649c4c5b8 100644
--- a/.github/scripts/issue-translation.cjs
+++ b/.github/scripts/issue-translation.cjs
@@ -810,6 +810,11 @@ function sanitizeTranslationBody(raw, maxChars = 60000) {
     // read as mention boundaries. Requiring a dotted domain keeps
     // "end!@octocat"-style mentions defused. \u0001 cannot appear in the
     // input (control chars were stripped above), so it is a safe sentinel.
+    // The lookbehind anchors on the @ itself rather than greedily matching
+    // the local part first: the previous local-part-first pattern rescanned
+    // long non-email tokens once per start position, which is quadratic on
+    // model-generated bodies with tens of thousands of consecutive
+    // local-part characters and no @ at all.
     .replace(
       /(?<=[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-])@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
       (emailTail) => emailTail.replace("@", "\u0001"),